bf938d651366648b6f568f1d86c5a1301bd1ed9e2b9c827a4ae2998956bb03a5

Analysis

max time kernel
150s
max time network
126s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
21/10/2023, 21:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
Size

33KB
MD5

c5c95a5b5ef9647cc82bda0fe0b4f250
SHA1

a664e3487a609967618686d8adc4bcf90416f21c
SHA256

bf938d651366648b6f568f1d86c5a1301bd1ed9e2b9c827a4ae2998956bb03a5
SHA512

075b1a4fdd237cc37c0e22ce3fb2446e526ba6756cb4001aefa1320807b7ca97f31c7a51091d84c8be83ddfb3ff673bacbc75d1ac7937fa34851e708895d86d2
SSDEEP

768:r5Gsq/XQGcoGVzUDWbcvZOkglUWJY3ggxfha54h:r5GD/XPgQGcvZORS3g+

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x00010000000108af-9.dat	aspack_v212_v242

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\7-Zip\Uninstall.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\ielowutil.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\chrome.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\ieinstal.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jre7\bin\java-rmi.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\jps.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2launcher.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\apt.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\java.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\DVD Maker\DVDMaker.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zG.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jre7\bin\jabswitch.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\iexplore.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\javap.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\jar.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\javac.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zFM.exe	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1736	1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe	28
PID 1640 wrote to memory of 1736	1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe	28
PID 1640 wrote to memory of 1736	1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe	28
PID 1640 wrote to memory of 1736	1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe	28
PID 1640 wrote to memory of 2244	1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe	30
PID 1640 wrote to memory of 2244	1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe	30
PID 1640 wrote to memory of 2244	1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe	30
PID 1640 wrote to memory of 2244	1640	NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe	30

C:\Users\Admin\AppData\Local\Temp\NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\at.exe
  at 1 /delete /yes
  2⤵
  PID:1736
- C:\Windows\SysWOW64\at.exe
  at 4:01:24 AM "C:\Users\Admin\AppData\Local\Temp\NEAS.c5c95a5b5ef9647cc82bda0fe0b4f250.exe"
  2⤵
  PID:2244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE

Filesize
151KB

MD5
e7dc3153b95fc3afeb74ff63943236f5

SHA1
856bd30f5b2185ec9958feed4fc8ef694c6050ab

SHA256
e281d0046b927bebc46ef07f7bd35fb46f5bc17b2f8c00f44bdcfc8677e12c94

SHA512
0265d0a4ee5f541252f0afe08f3e4c5e1eb95a1bffdfe2379032d5ed782eb5d944c830fcc283ec20acac91efa798bf51649d21b449b5899965114c959c1a570f

Download Submit
memory/1640-31-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1640-12-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1640-13-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1640-19-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1640-22-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1640-8-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1640-42-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1640-51-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1640-60-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1640-67-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1640-76-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1640-86-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1640-96-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1640-99-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download